diff options
| author | Johannes Berg <johannes@sipsolutions.net> | 2008-09-08 15:41:59 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2008-09-11 15:53:35 -0400 |
| commit | 9c80d3dc272ec5ce44a7564e5392f950ad38357a (patch) | |
| tree | 43b8e45567c790212581b117e9d06ae5f5fd975b /net | |
| parent | 5bda617576e58c7213aef5ab90383f303727b5b1 (diff) | |
| download | lwn-9c80d3dc272ec5ce44a7564e5392f950ad38357a.tar.gz lwn-9c80d3dc272ec5ce44a7564e5392f950ad38357a.zip | |
mac80211: fix action frame length checks
The action frame length checks are one too small, there's not just
an action code as the comment makes you believe, there's a category
code too, and the category code is required in each action frame
(hence part of IEEE80211_MIN_ACTION_SIZE).
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/mesh_hwmp.c | 4 | ||||
| -rw-r--r-- | net/mac80211/mesh_plink.c | 4 | ||||
| -rw-r--r-- | net/mac80211/mlme.c | 5 |
3 files changed, 11 insertions, 2 deletions
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c index eeb0ce2d5d37..59fd7fe377e0 100644 --- a/net/mac80211/mesh_hwmp.c +++ b/net/mac80211/mesh_hwmp.c @@ -581,6 +581,10 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata, size_t baselen; u32 last_hop_metric; + /* need action_code */ + if (len < IEEE80211_MIN_ACTION_SIZE + 1) + return; + baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt; ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable, len - baselen, &elems); diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c index 7714b0e6e4d7..74983cfa7293 100644 --- a/net/mac80211/mesh_plink.c +++ b/net/mac80211/mesh_plink.c @@ -421,6 +421,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m DECLARE_MAC_BUF(mac); #endif + /* need action_code, aux */ + if (len < IEEE80211_MIN_ACTION_SIZE + 3) + return; + if (is_multicast_ether_addr(mgmt->da)) { mpl_dbg("Mesh plink: ignore frame from multicast address"); return; diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index ae97d7e9945d..eb1832aa1fe5 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -60,7 +60,7 @@ #define ERP_INFO_USE_PROTECTION BIT(1) -/* mgmt header + 1 byte action code */ +/* mgmt header + 1 byte category code */ #define IEEE80211_MIN_ACTION_SIZE (24 + 1) #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002 @@ -2988,7 +2988,8 @@ static void ieee80211_rx_mgmt_action(struct ieee80211_sub_if_data *sdata, { struct ieee80211_local *local = sdata->local; - if (len < IEEE80211_MIN_ACTION_SIZE) + /* all categories we currently handle have action_code */ + if (len < IEEE80211_MIN_ACTION_SIZE + 1) return; switch (mgmt->u.action.category) { |